Company
Vulnerability intelligence company that tracks exploited CVEs, scanning activity, and initial-access threats, and acts as a CVE Numbering Authority.
VulnCheck counted Chrome CVEs up 563% and GitHub-issued CVEs up 476% year to date in a May 14, 2026 post. It calls the rise consistent with AI-assisted bug finding, but whether the volume lasts is unknown, so exploitation data still sets patch order.
Reality
Atlassian rates CVE-2026-21589 critical at CVSS 4.0 9.3, a no-login file-read flaw in every version of eight self-hosted products. Honeypots saw exploitation attempts by October 6, a day after the advisory, according to a dev.to write-up that found no public report of confirmed victims.
Reality
DeepSeek Harness, DeepSeek's open-source agent runner, carries a 9.4-severity flaw that lets a sandboxed agent grant itself full access with one command. Its control API has no authentication and trusts a client-supplied Host header.
Reality
Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishersReality
Anthropic's Cyber Verification Program now gives security teams three tiers of access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 for defensive work. Getting in takes organization verification and control attestations, and a team learns its tier only from its own admin view.
Perspective Coverage
14 publishersReality
Former NSA director Paul Nakasone called a reported five-part reorganization of the agency 'probably necessary' but said execution will decide it. He tied the case to attacker speed, citing CrowdStrike figures that put average lateral movement at 29 minutes.
Reality
VulnCheck says attackers are probing internet-facing Rejetto HFS servers for CVE-2026-61500, a signing-key flaw that gives full administrative control. The bug affects HFS 3.0.0 through 3.2.0, and the fix shipped in 3.2.1.
Reality
VulnCheck says a China-based actor began targeting vulnerable U.S. Rejetto HFS servers on October 1, exploiting CVE-2026-61500 to forge admin sessions. The fix shipped in July as version 3.2.1. Exposed instances that have not updated are reachable now.
Perspective Coverage
4 publishersReality
Cisco confirmed on September 9 that attackers are exploiting a CVSS 10.0 bypass in its Firewall Management Center to run code as root. CISA added it to its Known Exploited Vulnerabilities list the same day, with a three-day deadline for federal agencies.
Reality
Rejetto HFS 3.0.0 through 3.2.0 signs session cookies with a Math.random() key, and five leaked PRNG outputs let an attacker forge an admin session. Exploitation began on October 1, and version 3.2.1 restores secure key generation.
Reality
vm2's maintainer patched a CVSS 9.5 flaw in 3.12.2 where the module allowlist matched an approved path as a bare prefix and cleared a neighboring package. With NodeVM's default host context, the unapproved sibling ran with full Node authority.
Reality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
watchTowr says attackers are already pulling cloud credentials through MLflow's Tracking Server, and VulnCheck logged scanning against a FUXA path traversal a day later.
Perspective Coverage
5 publishersReality
A flaw in NASA's open-source AIT-GUI lets unauthenticated requests reach spacecraft command routes, and Cycode says a malicious web page can deliver them through an operator's browser.
Perspective Coverage
4 publishersReality
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishersReality
Manifold Security reported eight instances across seven command-line agents. The command runs as the user, outside the sandbox, with no approval prompt, and four were still firing when the researchers retested on September 1.
Reality
QTYF built and ran the scanning and routing frameworks other Chinese teams pointed at U.S. critical infrastructure. That means the proxy addresses and scan fingerprints in your logs point to the supplier; the intruder behind them stays unnamed.
Perspective Coverage
3 publishersReality
Disclosure volume is climbing faster than the process around it. CISA's answer is a framework that describes what a good CVE record is and how the program should be judged on producing one.
Perspective Coverage
3 publishersReality
Cisco Talos says three separate clusters, one sharing tooling with Sandworm, worked the same CVSS 10.0 bypass in Secure Firewall Management Center. The scope change in that vector reaches every firewall the console manages.
Reality
Build · August 28, 2026 · Confirmed2 publishers